catkeys.app serves this page's code. A compromised server could serve code that captures your password. Your data is encrypted in your browser and the server stores only ciphertext — but the browser client cannot protect you from the server itself.